CVE-2022-41678

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 85.81%
EPSS Percentile: 99.73%
CISA KEV: Not listed

Description

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 28-Nov-2023 23:15
Last Modified: 17-Jun-2026 12:03
EPSS Date: 2026-11-05
CWE: CWE-287

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Apache Software Foundation · Apache ActiveMQ Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 5.16.6 — affected (semver)
5.17.0 ≤ version < 5.17.4 — affected (semver)
5.18.0 — unaffected
6.0.0 — unaffected

collectionURL: https://repo.maven.apache.org/maven2
packageName: org.apache.activemq:apache-activemq

Affected Products / Versions

apache / activemq Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 5.16.6
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
apache / activemq Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.17.0 · before (exclusive) 5.17.4
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

References

Last enrichment sync: 06-Nov-2026 18:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

According to Horizon3.ai, the security defect is a bypass for CVE-2022-41678, a bug that allows authenticated attackers to trigger arbitrary code execution and write web shells to disk. Weekly Security Roundup Details Phorpiex Botnet, ActiveMQ RCE and AI-Related Threats
According to Horizon3.ai, the security defect is a bypass for CVE-2022-41678, a bug that allows attackers to write webshells to disk by invoking specific JDK MBeans. 13-Year-Old RCE Vulnerability Found in Apache ActiveMQ Classic

CVE (4)

Malware (13)

People (3)

Threat Actors (2)

MITRE ATT&CK (9)

Vendors (6)

Products (11)

Industries (7)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.